Online medical records.

Medical records services, such as Microsoft HealthVault and Google Health, promises an explosion in the storage of personal health-care information online.

While the services aim to make it easier for consumers to access and manage their personal health information, the ready availability of this data also makes it much easier and less expensive for insurers to put your medical history under the microscope. In fact, the number of companies that have legal access to this information runs into the millions, say privacy advocates.

Microsoft kicked off the beta test of its HealthVault service almost a year ago, while Google announced its Google Health service last February and launched a beta in May. While both services are still in beta, each company has partnered with large health-care providers for pilot tests: Microsoft with Kaiser Permanente and Google with the Cleveland Clinic. Microsoft, Google, and other companies that put your medical records online ensure that their security is top-of-the-line. Their services are intended to give consumers greater, not less, control over who sees what by giving consumers personal ownership of their information, according to the services.


Indeed, consumers' control of their health data is not the core problem. It's what happens to your information after its initial release that worries privacy advocates — and with good reason. For instance, a July article in Business Week cited the case of a Louisiana couple denied health insurance because the wife took two medications that set off red flags for a prospective insurer.

Most observers — including privacy advocates — state that the move to store our health records in the cloud is inevitable. In fact, there are many benefits to consumers for having that information available virtually instantly. For example, if you were in a different city and needed to be rushed to the emergency room, your health history would be immediately available to the physicians on call.

The downside is that storing health records online makes it easier for insurers to calculate the odds that you will be more expensive to insure than the next person. That's the rub, say privacy advocates. There is a law that keeps health data from being misused called the Health Insurance Portability and Accountability Act, or HIPAA. Moreover, there are many exceptions to the law. Additionally, both Microsoft and Google claim their health services are not subject to HIPAA regulation, since they don't offer health-care services themselves.


Patient Privacy Rights offers these recommendations and questions to safeguard your health-care records:-

• Don't even think about using a personal health record (PHR) that's offered by an employer or insurer. These are the last companies with which you want to share all your personal health and daily activities.

• Don't simply rely on a "HIPAA-compliant" PHR. HIPAA has more loopholes than the tax law; millions of businesses can legally access your information without your consent.

• How do you authorize access to the information? If gaining access requires nothing more than having someone guess your password, say "no, thanks."

• Does the PHR provider have the right under its "agreements" to take, sell, or share your information?

• What security does the PHR provide?

For the time being it would be advisable to hold off signing up for any electronic health-records system. Giving more time for the system to be tested out especially the potential for identity theft .

View blog reactions